geo-toolkit

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's geocoder.py uses geopy to call public providers (e.g., Nominatim/Google/Bing) and ingests their untrusted, user-contributed address/raw responses (see geocode(), reverse(), and geocode_csv()/reverse_csv()) which are read and used to drive downstream mapping and outputs, so third-party content can materially influence behavior.